The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 07:19
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a - Exploit, Third Party Advisory |
07 Jun 2023, 15:06
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Smackcoders import All Pages\, Post Types\, Products\, Orders\, And Users As Xml \& Csv
|
|
| CPE | cpe:2.3:a:smackcoders:import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv:*:*:*:*:wordpress:*:*:* |
Information
Published : 2022-10-17 12:15
Updated : 2024-11-21 07:19
NVD link : CVE-2022-3243
Mitre link : CVE-2022-3243
CVE.ORG link : CVE-2022-3243
JSON object : View
Products Affected
smackcoders
- import_all_pages\,_post_types\,_products\,_orders\,_and_users_as_xml_\&_csv
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')